dsbulk load requires MODIFY permission to load the data

[SuchithArodi]

./dsbulk --version
DataStax Bulk Loader v1.9.0

./dsbulk load -url /tmp/unload/requests -k KS -t TABLE -h IP1 -u USERNAME -p PASSWORD --connector.csv.maxCharsPerColumn -1
Username and password provided but auth provider not specified, inferring PlainTextAuthProvider
Operation directory: /tmp/dsbulk-1.9.0/bin/logs/LOAD_20220605-183958-188792
[driver] /IP2:9042 did not send an authentication challenge; This is suspicious because the driver expects authentication
[driver] /IP2:9042 did not send an authentication challenge; This is suspicious because the driver expects authentication
[driver] /IP2:9042 did not send an authentication challenge; This is suspicious because the driver expects authentication
[driver] /IP3:9042 did not send an authentication challenge; This is suspicious because the driver expects authentication
[driver] /IP3:9042 did not send an authentication challenge; This is suspicious because the driver expects authentication
[driver] /IP2:9042 did not send an authentication challenge; This is suspicious because the driver expects authentication
[driver] /IP2:9042 did not send an authentication challenge; This is suspicious because the driver expects authentication
[driver] /IP2:9042 did not send an authentication challenge; This is suspicious because the driver expects authentication
[driver] /IP3:9042 did not send an authentication challenge; This is suspicious because the driver expects authentication
[driver] /IP2:9042 did not send an authentication challenge; This is suspicious because the driver expects authentication
[driver] /IP3:9042 did not send an authentication challenge; This is suspicious because the driver expects authentication
[driver] /IP2:9042 did not send an authentication challenge; This is suspicious because the driver expects authentication
[driver] /IP3:9042 did not send an authentication challenge; This is suspicious because the driver expects authentication
[driver] /IP3:9042 did not send an authentication challenge; This is suspicious because the driver expects authentication
[driver] /IP2:9042 did not send an authentication challenge; This is suspicious because the driver expects authentication
[driver] /IP3:9042 did not send an authentication challenge; This is suspicious because the driver expects authentication
Operation LOAD_20220605-183958-188792 failed: User USERNAME has no MODIFY permission on table KS.TABLE or any of its parents.
com.datastax.oss.driver.api.core.servererrors.UnauthorizedException: User USERNAME has no MODIFY permission on table KS.TABLE or any of its parents
Suppressed: java.lang.Exception: #block terminated with an error
at com.datastax.oss.dsbulk.workflow.load.LoadWorkflow.execute(LoadWorkflow.java:230) [2 skipped]
at com.datastax.oss.dsbulk.runner.WorkflowThread.run(WorkflowThread.java:53)
total | failed | rows/s | p50ms | p99ms | p999ms | batches
2,986 | 0 | 86 | 35.61 | 100.14 | 100.14 | 1.00
Rejected records can be found in the following file(s): load.bad
Errors are detailed in the following file(s): load-errors.log
Last processed positions can be found in positions.txt

load-errors.log
Statement: com.datastax.oss.dsbulk.workflow.commons.statement.MappedBoundStatement1769d2e1 [33 values, idempotence: , CL: , serial CL: , timestamp: , timeout: ]
Resource: file:/tmp/unload/requests/output-000006.csv
Position: 109
Source: DATA
INSERT INTO KS.TABLE (attributes...) VALUES (...)
com.datastax.oss.dsbulk.executor.api.exception.BulkExecutionException: Statement execution failed: INSERT INTO KS.TABLE (attributes...) VALUES (...) (User USERNAME has no MODIFY permission on table KS.TABLE or any of its parents)
at com.datastax.oss.dsbulk.executor.api.subscription.ResultSubscription.toErrorPage(ResultSubscription.java:534)
at com.datastax.oss.dsbulk.executor.api.subscription.ResultSubscription.lambda$fetchNextPage$1(ResultSubscription.java:372)
at com.datastax.oss.driver.internal.core.cql.CqlRequestHandler.setFinalError(CqlRequestHandler.java:450) [4 skipped]
at com.datastax.oss.driver.internal.core.cql.CqlRequestHandler.access$700(CqlRequestHandler.java:95)
at com.datastax.oss.driver.internal.core.cql.CqlRequestHandler$NodeResponseCallback.processErrorResponse(CqlRequestHandler.java:766)
at com.datastax.oss.driver.internal.core.cql.CqlRequestHandler$NodeResponseCallback.onResponse(CqlRequestHandler.java:658)
at com.datastax.oss.driver.internal.core.channel.InFlightHandler.channelRead(InFlightHandler.java:257)
at java.lang.Thread.run(Thread.java:748) [24 skipped]
Caused by: com.datastax.oss.driver.api.core.servererrors.UnauthorizedException: User USERNAME has no MODIFY permission on table KS.TABLE or any of its parents

Not sure why dsbulk load needs the MODIFY permission to load the data.
Note: target Cassandra cluster IP1 has the auth enabled but IP2 and IP3 don't have the auth enabled, so we see the warning messages.

┆Issue is synchronized with this Jira Task by Unito

[adutra]

Hi @SuchithArodi thanks for reporting this.

It's not DSBulk that needs such permissions, it's Cassandra itself. Check database roles and permissions here:

https://cassandra.apache.org/doc/latest/cassandra/cql/security.html

As you see in the table, the MODIFY permission is required to execute INSERT statements.

[SuchithArodi]

Thanks for the clarification @adutra

[adutra]

Thanks @SuchithArodi. I'll go ahead and close this issue.